42259f620de33f4271bd4a2c1cad7f21631c56034b5e0fd65a5a9609df74aecc

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/10/2026, 23:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan.Win32.Agent.qwglgk.exe
Size 821KB
Sample261015-296ajsys4q
SHA256 42259f620de33f4271bd4a2c1cad7f21631c56034b5e0fd65a5a9609df74aecc
MD5 5639ede3fff95b63490ad062a694209a
SHA1 d2f8b46be47336ea1bd13882b68db80357493cd6
SHA512 d9b13008be8ae9fc86c9480c793e4b52c54fac9ed63c0ff1e72a08c1a83e93d89be749f2499d4f6224d8def13fb8146f94f8053439318b8f591f2a614980ab55
SSDEEP 24576:IKcy8DNOozVsceh5KwvxqIcGg+uxfEuPAsSLWCBFWp:IKLWtqchw0GYxF
TLSH
T159051203B6D48136CD7513F449F90AD30A7ABDE24F7C928F2345659B4CB22C4A972B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence spyware trojan

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe

Manipulates Digital Signatures 1 TTPs 4 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.1!7\Name = "szOID_ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION"	certutil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.2!7\Name = "szOID_ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION"	certutil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.3!7\Name = "szOID_ROOT_PROGRAM_NO_OCSP_FAILOVER_TO_CRL"	certutil.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates\D4A090F7C4B9D22E9BFD1D2E991CF938A79458E4\Blob = 030000000100000014000000d4a090f7c4b9d22e9bfd1d2e991cf938a79458e40b000000010000005a00000049006e0076006f0069006300650053006d0061007300680020004400650076002000530065006c0066002d005300690067006e00650064002000530053004c0020004300650072007400690066006900630061007400650000000200000001000000dc0000001c0000007c000000010000000000000000000000000000000100000049006e0076006f0069006300650053006d0061007300680020004400650076002000530065006c0066002d005300690067006e00650064002000530053004c0020004300650072007400690066006900630061007400650000000000000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e003000000000002000000001000000f7030000308203f3308202dba003020102020101300d06092a864886f70d01010b05003081b13133303106035504030c2a496e766f696365536d61736844657620526f6f7420436572746966696361746520417574686f72697479310c300a06035504080c034e5357310b3009060355040613024155312c302a06092a864886f70d010901161d737570706f72742e7465616d40626c6168626c6168626c61682e636f6d311b3019060355040a0c12436f75706120496e766f696365536d61736831143012060355040b0c0b446576656c6f706d656e743020170d3138303331333130353033385a180f32303638303232393130353033385a3081903115301306035504030c0c2a2e676f6f676c652e636f6d310c300a06035504080c034e5357310b30090603550406130241553129302706092a864886f70d010901161a696e766f696365736d6173687465616d40636f7570612e636f6d311b3019060355040a0c12436f75706120496e766f696365536d61736831143012060355040b0c0b446576656c6f706d656e7430820122300d06092a864886f70d01010105000382010f003082010a0282010100d8936c188dc15764dc09c10b6fbc955d21fc556eb62a399910198ddcea4316d24561fe11aa74bce9217009b56003accd1212d1bcc5ffe8c44310148286bd48c1d6d17080cd689fa8db24ddb6afa52f6948ed4161e42be1cb735b5606d3d30d5e6d9d9d124189bb9a09d65b58a64deba7ebf9e09996d0395e3ee6680db650903ab673756cfbf18ecdf9b717141e54516a88bda50b292d1f086e95029b9d452fee54e3c403ed09e211935bfefbd03c9496331b45c7c3b5e27ae3c5ce0f8a6cee9a8056f4c576468b572c649b8e5a7855fab161af8b01aedcbf098779fe14aea78e3dd67bc863da47084859d500a00ac4895d8af781e8a03e66980852c200eae6870203010001a333303130090603551d1304023000300b0603551d0f0404030205e030170603551d110410300e820c2a2e676f6f676c652e636f6d300d06092a864886f70d01010b05000382010100ca846d6c4e6836489eca2f24194bb831381e3c160e291136fc2b5010d7c2f9ce71ebfdb31ae437241f957c9d93a82154307c99ad7d8f4dd8632fd8a4f489d7994811c6c05dffd2c90849f1839973145650acc3049e098504aeb1d29f6e43604772cde7ae7d43d4403c0231e7bd07b8a609a3751931975a08047deacc2af64520b1b0984a3991ba19c6e881d029d962dc27dc23165069e66a847f916b097feb277ca5f6d27604aafe974c6d686a0b4d6b1111d809e908ee2b96e92bf4bf4c5442725a9178c8bb2c8100729e1283e396599fc31f0782c5b07bb5c4d607361a4810c3a274dfbee10d318bb8c63a4a9c477542fd7ed0209418f9b05ad360115fc29e	EiTvwk7bRE.exe

Executes dropped EXE 2 IoCs

pid	Process
4492	7za.exe
4984	EiTvwk7bRE.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	jaffacakes118_Trojan.Win32.Agent.qwglgk.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 6 IoCs

execution

Visual Basic

T1059.005

pid	Process
1856	WScript.exe
5864	WScript.exe
4876	WScript.exe
5424	WScript.exe
2736	WScript.exe
2124	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4080	cmd.exe
5836	cmd.exe
3648	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WScript.exe

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EiTvwk7bRE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	certutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.Agent.qwglgk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings	cmd.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates\D4A090F7C4B9D22E9BFD1D2E991CF938A79458E4\Blob = 030000000100000014000000d4a090f7c4b9d22e9bfd1d2e991cf938a79458e40b000000010000005a00000049006e0076006f0069006300650053006d0061007300680020004400650076002000530065006c0066002d005300690067006e00650064002000530053004c0020004300650072007400690066006900630061007400650000000200000001000000dc0000001c0000007c000000010000000000000000000000000000000100000049006e0076006f0069006300650053006d0061007300680020004400650076002000530065006c0066002d005300690067006e00650064002000530053004c0020004300650072007400690066006900630061007400650000000000000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e003000000000002000000001000000f7030000308203f3308202dba003020102020101300d06092a864886f70d01010b05003081b13133303106035504030c2a496e766f696365536d61736844657620526f6f7420436572746966696361746520417574686f72697479310c300a06035504080c034e5357310b3009060355040613024155312c302a06092a864886f70d010901161d737570706f72742e7465616d40626c6168626c6168626c61682e636f6d311b3019060355040a0c12436f75706120496e766f696365536d61736831143012060355040b0c0b446576656c6f706d656e743020170d3138303331333130353033385a180f32303638303232393130353033385a3081903115301306035504030c0c2a2e676f6f676c652e636f6d310c300a06035504080c034e5357310b30090603550406130241553129302706092a864886f70d010901161a696e766f696365736d6173687465616d40636f7570612e636f6d311b3019060355040a0c12436f75706120496e766f696365536d61736831143012060355040b0c0b446576656c6f706d656e7430820122300d06092a864886f70d01010105000382010f003082010a0282010100d8936c188dc15764dc09c10b6fbc955d21fc556eb62a399910198ddcea4316d24561fe11aa74bce9217009b56003accd1212d1bcc5ffe8c44310148286bd48c1d6d17080cd689fa8db24ddb6afa52f6948ed4161e42be1cb735b5606d3d30d5e6d9d9d124189bb9a09d65b58a64deba7ebf9e09996d0395e3ee6680db650903ab673756cfbf18ecdf9b717141e54516a88bda50b292d1f086e95029b9d452fee54e3c403ed09e211935bfefbd03c9496331b45c7c3b5e27ae3c5ce0f8a6cee9a8056f4c576468b572c649b8e5a7855fab161af8b01aedcbf098779fe14aea78e3dd67bc863da47084859d500a00ac4895d8af781e8a03e66980852c200eae6870203010001a333303130090603551d1304023000300b0603551d0f0404030205e030170603551d110410300e820c2a2e676f6f676c652e636f6d300d06092a864886f70d01010b05000382010100ca846d6c4e6836489eca2f24194bb831381e3c160e291136fc2b5010d7c2f9ce71ebfdb31ae437241f957c9d93a82154307c99ad7d8f4dd8632fd8a4f489d7994811c6c05dffd2c90849f1839973145650acc3049e098504aeb1d29f6e43604772cde7ae7d43d4403c0231e7bd07b8a609a3751931975a08047deacc2af64520b1b0984a3991ba19c6e881d029d962dc27dc23165069e66a847f916b097feb277ca5f6d27604aafe974c6d686a0b4d6b1111d809e908ee2b96e92bf4bf4c5442725a9178c8bb2c8100729e1283e396599fc31f0782c5b07bb5c4d607361a4810c3a274dfbee10d318bb8c63a4a9c477542fd7ed0209418f9b05ad360115fc29e	EiTvwk7bRE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates\D4A090F7C4B9D22E9BFD1D2E991CF938A79458E4	EiTvwk7bRE.exe

Runs .reg file with regedit 1 IoCs

pid	Process
1812	regedit.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	4492	7za.exe
Token: 35	4492	7za.exe
Token: SeSecurityPrivilege	4492	7za.exe
Token: SeSecurityPrivilege	4492	7za.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 4080	2532	jaffacakes118_Trojan.Win32.Agent.qwglgk.exe	90
PID 4080 wrote to memory of 4492	4080	cmd.exe	92
PID 4080 wrote to memory of 2124	4080	cmd.exe	94
PID 4080 wrote to memory of 5836	4080	cmd.exe	96
PID 5836 wrote to memory of 4196	5836	cmd.exe	97
PID 4080 wrote to memory of 3648	4080	cmd.exe	98
PID 3648 wrote to memory of 3328	3648	cmd.exe	99
PID 4080 wrote to memory of 1856	4080	cmd.exe	100
PID 4080 wrote to memory of 3452	4080	cmd.exe	101
PID 4080 wrote to memory of 4984	4080	cmd.exe	102
PID 4080 wrote to memory of 5864	4080	cmd.exe	103
PID 4080 wrote to memory of 828	4080	cmd.exe	104
PID 4080 wrote to memory of 4876	4080	cmd.exe	105
PID 4080 wrote to memory of 5424	4080	cmd.exe	106
PID 4080 wrote to memory of 1812	4080	cmd.exe	107
PID 4080 wrote to memory of 2736	4080	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Agent.qwglgk.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Agent.qwglgk.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\SysWOW64\cmd.exe
  cmd /c run.cmd
  2⤵
  - Drops file in Drivers directory
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4080
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7za.exe
    7za.exe e -phWfRbHQLGN3XOqi1 tLyEGvwruO.7z
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4492
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h9duWHeJDA.vbe" 877049134 noChannel installStart
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:2124
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\Software\WWthr" /v UUID
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5836
  - - C:\Windows\SysWOW64\reg.exe
      REG QUERY "HKEY_CURRENT_USER\Software\WWthr" /v UUID
      4⤵
      System Location Discovery: System Language Discovery
      PID:4196
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\Software\Tempthr" /v UUID
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3648
  - - C:\Windows\SysWOW64\reg.exe
      REG QUERY "HKEY_CURRENT_USER\Software\Tempthr" /v UUID
      4⤵
      System Location Discovery: System Language Discovery
      PID:3328
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h9duWHeJDA.vbe" 877049134 noChannel importCerts
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:1856
- - C:\Windows\SysWOW64\certutil.exe
    certutil -addstore Root TBBcP5zlvV.crt
    3⤵
    - Manipulates Digital Signatures
    - System Location Discovery: System Language Discovery
    PID:3452
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\EiTvwk7bRE.exe
    EiTvwk7bRE.exe -f oMKS4AYtMj.pfx -p aaahahaa -t MACHINE -s TRUSTEDPEOPLE
    3⤵
    - Manipulates Digital Signatures
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    PID:4984
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h9duWHeJDA.vbe" 877049134 noChannel addNativeMessagingHost
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:5864
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKLM\Software\Google\Chrome\NativeMessagingHosts\com.ww.fm" /ve /t REG_SZ /d C:\Users\Admin\AppData\Roaming\ww.fm\ww.json /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:828
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h9duWHeJDA.vbe" 877049134 noChannel addHosts
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:4876
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h9duWHeJDA.vbe" 877049134 noChannel addRegkeys
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:5424
- - C:\Windows\SysWOW64\regedit.exe
    regedit /S OwO7lakok1.reg
    3⤵
    - System Location Discovery: System Language Discovery
    - Runs .reg file with regedit
    PID:1812
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h9duWHeJDA.vbe" 877049134 noChannel installSuccess
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:2736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7za.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7za.exe
Size 676KB
SHA256 e6855553350fa6fb23e05839c7f3ef140dad29d9a0e3495de4d1b17a9fbf5ca4
MD5 2e3309647ce678ca313fe3825a57ccb9
SHA1 792fdeccddd3cc182eac3a1ecd7affe5b48262c8
SHA512 5eb2af380fed7117d45232d42dec4d05a6f4f6cd6c7d03583c181b235344ea922290b6e0bf6b9683592bccc0f4a3b2b9b9fd7d41fbfebf1045bd95b027539dbc
SSDEEP 12288:bG7V/OPngTonh/Unv3Kfgk0ty7k+ISk5vrnY+F4nI5nP5l0pi:bK/vShG3Kf70ok3fhrnY+F4AnRl0p
TLSH
T18EE48D223BF6C1BBC25201318A1DABF5D1F6F3190B2559C363808F1D6B399D5D63AE1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EiTvwk7bRE.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\EiTvwk7bRE.exe
Size 36KB
SHA256 baf5227825effdd59086816d2e757bf8d2bac7d1164cb50333d45af581c2d22a
MD5 feaa36badce5cdb3172799adef6dfbfb
SHA1 ce97af15eb7ebde0e26b74323728da4340e8fcee
SHA512 aec22f9ae9dfe7b24c2ebf34caf3cbae432255074346f0ab712d1bc1795250f24b421f76cff20475cfde291ce81bc478c4f284b6f9659e3cee77f9c9dd41ea55
SSDEEP 384:NaapPoDmlj8J/iKuTDuSGX4YL3DUViy1ugpchyHnBRAVwSetgdCo6ozb4:NfpB8Z1MDuv4YLgViy7QRfetg2cb
TLSH
T1DDF28C1B78D1C473E48285F0A1754F2AE73FA62203615942E75CA9693E71AE0CE7E387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OwO7lakok1.reg

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OwO7lakok1.reg
Size 425B
SHA256 2d0a8e0f3f434a8d79d5765488f5cfcfc1781f5c06aaf8d39cbd80b1c0b55845
MD5 57a8a1d06922dbafdd6e3e55044d5096
SHA1 4f4f9e05b3dd2e7f1de19edc5bb432d6059a1c6b
SHA512 9607a6645bb6121172c0d094ab98b7f10b6b65900853044fdc43f5214b811b259bbad03efafc94564593e65470039819694a24e2f8dc74a1fd22a3bf95af838c
TLSH
T1C7E06DA32DA1125E00F1D941DFE4E0C21BFDA93861E3AC2060CA909236DADC3149C66F
MD5 SHA1 SHA512 TLSH

Submit Download

TBBcP5zlvV.crt

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TBBcP5zlvV.crt
Size 1KB
SHA256 46c116d33c5a9d041dad32717878b76e2fd46fa74189c8ab7dbfacfe0f38baa8
MD5 f72aff409cab538c3111fe29d44739e3
SHA1 1204623030a35fe9c6bb27f2f645105aac11cada
SHA512 1d33771682c6aa45e6a1a090fbb294d5938fc974e45c9bdda3d556ea16df81a06b0aecd712af1e45e0ae23b38add975bca106b6562d4a6bc2c2c0008ef4e6844
TLSH
T17521199CEEF37E875407D066C65E530E059B4F8622CBE0C29D2B5D8882B775E840C198
MD5 SHA1 SHA512 TLSH

Submit Download

h9duWHeJDA.vbe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h9duWHeJDA.vbe
Size 1KB
SHA256 7c9384f62b40b6b4f92c368925e248f7067814cd08311577e30936286baf23dc
MD5 570a4798955a0367dd49cba6f7e4d79c
SHA1 598c1a8929210ef01fcba506cbef421d216801c2
SHA512 9b1926a6495aee53fe57a4132d8da63f6e0643a13a7fdda3ead41d2d6a32ccc6f421767a7fc03983619223e85ef05f0f715c61dc36d1486fbc9c055e0d1ae2c0
TLSH
T1A12196877AF626499C6A616264C33189804FD44AF51768E87063FD495150F4AFC691A3
MD5 SHA1 SHA512 TLSH

Submit Download

oMKS4AYtMj.pfx

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\oMKS4AYtMj.pfx
Size 2KB
SHA256 1182a9c71d18b07a82ada2feaa68edbed2d0634f2bbbf5733df836f1f8846d9d
MD5 67e0312dec627268f16fc71bfe1bfc4f
SHA1 a7696182729b7b59c9b55b01b9352349bc0f14fd
SHA512 b32dfc9768d95f16b5c0061db15313b66f5a6c6422b1feda8d38ca7c0d43b2236c75a4fc4dd0af1262bb9cac926485668d7017a46569923be8ee5d5f2db22b73
TLSH
T1E3512B6734F80C537A6E4EEC721E0D5E984547D8BC4920BEA73B05E0041DEA595DF930
MD5 SHA1 SHA512 TLSH

Submit Download

rr.vbe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rr.vbe
Size 2KB
SHA256 d7e78a71845b377b3169c11f13cd2883284d5952481c0ffe985730996ccf6984
MD5 e5f541f1c0a2bef2e99ba59a7efc07b7
SHA1 62766c110d579b8172ab58be96bc06e49a6fce04
SHA512 8a305ac43cc49c0a9e826949bdb44b326d04c6eae5afcf3ffc4c229ffd32fb607a71b910de8ed1d3f52e272a9c61ee26750a8cbd052be458dab1966162e7aeb0
TLSH
T1BC512A76017A17AF0EEABB4C92BC9149B10E4F2744EC10894457CC6E21B55EBFFAD436
MD5 SHA1 SHA512 TLSH

Submit Download

run.cmd

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\run.cmd
Size 61B
SHA256 3c688e78b709bb4ab9249e421eaedef61acce044e9634cf864b4adf38c7b3231
MD5 5f29996684825cfdbbef44e3e9def0df
SHA1 8a1eba9c342d437d35b668e4121f02bb1c2db105
SHA512 f875bd73f71368e07c878b2267e06d758ff47ee49847f08b0d0a92680a1d45f93d223cc809b0774c50d8f2b2e88efed6f349cf3b4042c336f4a9b0362a933ccd
TLSH
T1DBA0023CED8BE5D355229DAC9D00984E969F94525294602548561595891BD8C2958209
MD5 SHA1 SHA512 TLSH

Submit Download

tFzlNvPs0q.bat

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tFzlNvPs0q.bat
Size 1KB
SHA256 81a87c61b23832b6577ef1657286231e12339ccd4ef09193d6910d2c74ee16a1
MD5 617ec98996280e312eff357435435517
SHA1 25239b11869c33d09c9f446069cbeddd6b43ba29
SHA512 498e34816d0f8e5b668c3ad27197ce461e1cc4ba70c55640a377fcf62fbab85380593909fcc7770e1ba616589877ac4b06f7b02e92544df3ae46eb30e05b6ad2
TLSH
T1D031208CF91EFD1080C84E040A3A6887D39AD7DFC0E5F9C4097B12B86C21C80EA16AF1
MD5 SHA1 SHA512 TLSH

Submit Download

tLyEGvwruO.7z

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tLyEGvwruO.7z
Size 305KB
SHA256 e7128176f2555fc751079397ee3d7c561463bb1c366bdc0e2612846999f0173c
MD5 eb25be71d46a7abb44e92505fa7a2aa7
SHA1 ff1143d077d924b6dc4848880afcb8106dde465c
SHA512 da64beca937c042617121a946fa86072215faf8620c5b907e1a426119205a96d4b15f473d00425ba5678fcc4c340cbe1d5a8da54a4aba25a5098dfc27ead7863
SSDEEP 6144:ziLpjYnY1mXOT9LkB9vK42EcaQUPwcRtiSlv7PCecnFqFKBjByZhIDCMw:+tjtDZq9vWElPwcHiSlvDCJFSKhBQhY2
TLSH
T1FE6423C579875A8FC732E7B81E889C1DC983CBE6B5B963CD6103B778C854AC41825758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ww.bat

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ww.bat
Size 186B
SHA256 fc48e803e29dfb63787d950e3a409d8317c7400bea48daecea098d4d1222726a
MD5 f6c0446d90c9be1a4ccae59df5f79bc4
SHA1 e6e5115f855f1b2ecbf82756c5087c47d357eda5
SHA512 df09d1329976656f3c5f877e3f68783015e316a3f9c9ef24b53ac70a75b7c1b5a056d61a6a1931230bd6d4cee3ee760ebcc8001b1437488f39d1862a416f188c
TLSH
T1A6C012A8D70D05E4A2411E94AB4640C095E4D39F3383D4D3617211B2D881D20D105B03
MD5 SHA1 SHA512 TLSH

Submit Download

ww.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ww.exe
Size 1.3MB
SHA256 310c2f487bad8c31cf03542c68a4d65d26a177b36d3b44d37ea82177f35cab3e
MD5 9ff0943f6bb9d87b41b0945006cc3811
SHA1 88f26af051f0d56cec84b74a25cdc573e817dc00
SHA512 3f75aa614ba86842bec29d8dd3cdd2901ae0b11b98324c126fd61c4cb688141edf8728ca62595597f051272bb41f8512ccb5898a05896235cd47988d04be9ced
SSDEEP 24576:cgllFKtmWCpv3hI20iRI4OFbZQN2BuQ5y3h3ol2iV:R2Cp5IrVl2iV
TLSH
T1AD550A93AACB0EB2CDE327F055C753766338DE508A26CF6BE608C5369E936C56C49701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ww.json

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ww.json
Size 190B
SHA256 b71b254e07ec995ed4b7a8e411fbb5e3e03d247a1d6ade807031dcf2441661a6
MD5 400d65242dcaae6cfe505c27b34e276e
SHA1 c0b89c06c0834610293f3dfa68a5fd8e9cba2204
SHA512 bca13eb29c577d56d3f6838e7ce1b46bc6ddbc9b67490fced137bf09c2bf88852dbb87d4be50ce7084107f156440a160b5aff306e968e22a0f6344e87cba6589
TLSH
T166C02233AA94C00204F9838008B4040372269F0F01359D2338FF01281E60601484AF29
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads